Agent runbook & audit cycle

Living runbook for your agent fleet. Audited weekly so it doesn't rot.

## How to use

1. Edit the **Runbook** doc below with your actual fleet (which agents, what scopes).
2. Fill **Allowed tools** with the tools each agent can call (read-only / read-write / dangerous).
3. Wire your fleet to write to **Audit log** on every meaningful action.
4. Sunday night: read the auto-drafted **Compliance score** doc. Decide if any runbook section needs an edit.

## Agents in this org

| Agent | Role | Owner | In scope | Out of scope |
|-------|------|-------|----------|--------------|
| Scout | research / read-only | [you] | Read any workspace, draft summaries | Write to billing surfaces |
| Argus | drafting / write | [you] | Draft into doc surfaces | Send external email |
| Flint | operations / scheduled | [you] | Move rows between surfaces | Delete rows |

## Allowed tools

Use the **Allowed tools** surface. Each row: tool · scope (read-only / read-write / dangerous) · which agents can use it · last-reviewed date.

## Scope rules

- Stay within your agent's named scope. Don't drift.
- Read before acting. Always.
- Anything that costs money / widens access / is irreversible → use the dangerous-op gate.

## Dangerous-op convention

First call returns a confirm token + summary. Agent surfaces summary to user in chat. User confirms. Agent retries with token. Never bypass.

## Escalation

Append to **Audit log** with `event_type: escalation`. Compliance pass surfaces patterns weekly.

## When you're done (each Sunday)

Your audit agent drafts the **Compliance score** doc:
- Score (% of actions in scope)
- Top 3 drift patterns
- Runbook updates proposed
- Tools to deprecate / add

Read in 2 minutes Sunday night. Edit runbook accordingly. Cycle continues.

Fork to next cycle

When you're done, fork the workspace for the next cycle. The new workspace will be seeded with your structure, your customizations, and this cycle's retro as your agent's first Status entry — so it picks up context-aware from where this one left off. Same template, next cycle, no manual setup.